TLDR INFORMATION SECURITY 2025-09-09

Get the guide 📥

FINANCIAL SERVICES FIRM WEALTHSIMPLE DISCLOSES DATA BREACH

Canadian financial services firm Wealthsimple disclosed a data breach detected on August 30 that exposed the personal information of fewer than 30,000 customers (less than 1% of its 3 million client base) through a compromised third-party software package. The stolen data included contact details, government IDs, financial account numbers, Social Insurance Numbers, IP addresses, and dates of birth. No passwords or customer funds were compromised. Wealthsimple is providing affected customers with two years of free credit monitoring, dark-web monitoring, identity theft protection, and insurance. It confirmed the incident was unrelated to recent Salesforce breaches.

GHOSTACTION ATTACK STEALS 3,325 SECRETS FROM GITHUB PROJECTS

The GhostAction supply chain attack compromised 817 GitHub repositories by injecting malicious workflow files that appeared to be routine automation scripts but actually exfiltrated CI/CD secrets to an external server. The campaign affected 327 developers across multiple programming languages, stealing 3,325 secrets, including npm, PyPI, DockerHub tokens, and AWS credentials that could enable further attacks on software supply chains. The attackers personalized each commit and analyzed legitimate workflows to identify which secrets to target. At least 24 projects (9 npm and 15 PyPI) remain at risk from compromised tokens despite no confirmed malicious package releases yet.

OVER 6,700 PRIVATE REPOSITORIES MADE PUBLIC IN NX SUPPLY CHAIN ATTACK

Hackers used stolen secrets from Nx to expose over 6,700 private repositories in a major supply chain attack that targeted hundreds of organizations. The threat actors leveraged malicious Nx packages to steal API keys and credentials, and exploited the compromised accounts to publish sensitive data from private repositories to public GitHub repositories.

GPUGATE MALWARE: MALICIOUS GITHUB DESKTOP IMPLANTS USE HARDWARE-SPECIFIC DECRYPTION, ABUSE GOOGLE ADS TO TARGET WESTERN EUROPE

Russian-speaking threat actors deployed the "GPUGate" campaign using a sophisticated multi-stage attack combining Google Ads malvertising, GitHub commit manipulation, and hardware-specific GPU-gated decryption to target Western European IT professionals with fake GitHub Desktop installers. The attackers leveraged Google's paid search results, modified legitimate GitHub repository commits to include malicious download links, and created 128MB installers with OpenCL-based decryption that only executes on systems with real GPUs (device names >10 characters), effectively bypassing sandbox analysis. The campaign demonstrates advanced evasion tactics, including UAC bypass, Windows Defender exclusions, persistence through scheduled tasks, and modular payload delivery, with the ultimate goal of credential theft, lateral movement, and potential ransomware deployment targeting high-value IT sector victims.

REVERSE ENGINEERING OF APPLE'S IOS 0-CLICK CVE-2025-43300: 2 BYTES THAT MAKE SIZE MATTER

CVE-2025-43300 is a zero-click out-of-bounds write vulnerability in the ImageIO framework that occurs when processing DNG images with JPEG lossless compression. Exploited in the wild, the vulnerability stems from incorrect buffer allocation and loop bounds in the lossless JPEG decompression code, where the system assumes at least two components per pixel but processes images with only 1 component, causing writes beyond allocated memory. Apple's patch adds bounds checking to verify buffer size before each write operation and raises an exception when the buffer would be exceeded, fixing the mismatch between allocated buffer size (based on components per pixel) and actual write operations.

ESCAPING THE CONFINES OF PORT 445

Attackers are restricted to using port 445 when performing NTLM relay attacks on SMB in Active Directory environments. A common strategy to get around this limitation is by extracting the SAM and SYSTEM registry hives to dump NT hashes, but this often triggers alerts or is blocked by EDR. This article details a technique that uses Service Control Manager (SCM) to start the Webclient service, which offers more lateral movement options.

Download the Report

DITTOBYTES

Dittobytes compiles C-code into truly Position Independent Code (PIC) for Windows, macOS, and Linux. Supporting AMD64 and ARM64, it has a metamorphic engine that ensures each compile produces unique, functional shellcode. The resulting shellcode is very small and simple and has minimal overhead.

FIRECOMPASS (PRODUCT LAUNCH)

FireCompass is a platform that integrates attack surface management, continuous threat exposure management, network and application penetration testing, penetration testing as a service, and red teaming.

FINDMYTAKEOVER

findmytakeover is a tool that detects dangling DNS records in a multi-cloud environment. It achieves this by scanning all DNS zones and infrastructure within the configured cloud service provider, whether in a single or multiple accounts, to identify DNS records for which the underlying infrastructure no longer exists, rather than relying on a wordlist.

GERMANY CHARGES HACKER WITH ROSNEFT CYBERATTACK IN LATEST WAKE-UP CALL FOR CRITICAL INFRASTRUCTURE

German prosecutors charged a 30-year-old man with computer sabotage, data alteration, and espionage for attacking Rosneft Deutschland in March 2022, stealing and deleting 20 terabytes of data while leaving a "Glory to Ukraine" message, costing the company €12.36 million in damages. The attack, conducted in the aftermath of Russia's invasion of Ukraine, exposed sensitive internal communications and corporate documents, with the stolen data later distributed by the Anonymous hacktivist collective. The incident highlights the vulnerability of critical energy infrastructure to cyberattacks, particularly during geopolitical tensions, emphasizing the need for enhanced cybersecurity measures in essential services sectors.

SEXTORTION WITH A TWIST: SPYWARE TAKES WEBCAM PICS OF USERS WATCHING PORN

A new variant of spyware called Stealerium can automatically take webcam photos of people while they watch porn, then send these to hackers for possible blackmail. Distributed as free, open-source code, it infects users via phishing emails. Researchers say this marks a move from large-scale ransom to more personal extortion, and warn it's hard to track individual victims.

THE CRAZY, TRUE STORY BEHIND THE FIRST AI-POWERED RANSOMWARE

NYU researchers built an AI-powered ransomware as a proof-of-concept, showing how large language models can automate targeted ransomware attacks. Their project, initially intended for research purposes, was flagged by security experts as a real threat after it was uploaded to VirusTotal. The experiment highlights growing concerns that, soon, cybercriminals will be able to easily weaponize AI for sophisticated, undetectable attacks.

incident. Read the full analysis

MAX SEVERITY ARGO CD API FLAW LEAKS REPOSITORY CREDENTIALS

A maximum severity vulnerability (CVE-2025-55190, CVSS 10.0) in Argo CD allows API tokens with minimal project-level get permissions to bypass isolation mechanisms and retrieve all repository credentials, including usernames and passwords.

NPM DEBUG AND CHALK PACKAGES COMPROMISED

Attackers injected malware into npm packages like debug, chalk, supports-color, and strip-ansi, targeting crypto/web3 wallets in browsers.

GITHUB ACCOUNT COMPROMISE LED TO SALESLOFT DRIFT BREACH AFFECTING 22 COMPANIES

Hackers accessed Salesloft's GitHub account between March and June, stealing security tokens linked to 22 companies and prompting the company to disable Drift, reset credentials, and enhance security measures.